I disappeared for 5 months to build a security scanner. Here is what I learned (and how you can break it).

Description and use

Permi is an open‑source security scanner tailored for African fintech and healthtech, addressing local vulnerabilities, reducing false positives with AI, and producing compliance reports.

Problem

Global security scanners miss local fintech/healthtech vulnerabilities and generate many false positives, making them ineffective for regulated African ecosystems.

Outcome

Permi reduces false positives by ~95% and produces compliance documentation tailored to African fintech/healthtech contexts.

Workflow

• Install Permi via pip
• Run "permi setup --api-key YOUR_API_KEY_HERE" to configure OpenRouter API
• Execute "permi scan ./your-codebase" to scan the repository
• AI filters findings and outputs a 20‑item governance checklist
• Generate Excel Readiness Workbook and PDF report

Evidence

global scanners like Snyk or Semgrep are great—until you realize they don't know what a BVN (Bank Verification Number) or a USSD session flaw looks like.

Source

AI Noise Reduction: Passing the raw findings to an LLM (via OpenRouter) to verify if a finding is a real vulnerability or a false positive. This cuts the noise by ~95%.

Source

The "Evidence" Problem: Compliance officers (DPOs) can't read terminal output. So I built a system that takes the technical scan and pairs it with an automated 20-item governance checklist, generating a complete Excel Readiness Workbook and PDF report.

Source